Read the docs
TI-2017-07190 Aliases CVE-2017-9810GHSA-2h9w-xq69-f5qj

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus…

Priority MEDIUM 42CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.

Why it matters now

EPSS 0.01932 80th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kaspersky:anti-virus_for_linux_server:*:*:*:*:*:*:*:*up to 8.0.3.297VulnerableKaspersky
  • cpe:2.3:a:kaspersky:anti-virus_for_linux_server:*:*:*:*:*:*:*:* Versions up to 8.0.3.297 Vulnerable ·Kaspersky

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9810
  2. 2026-10-03 Alias added: GHSA-2h9w-xq69-f5qj

References

Exploit 4

  • TI-2017-07191 The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for… CVSS 3.0CRITICAL 9.8
  • TI-2017-07192 The reportId parameter of the getReportStatus action method can be abused in the web… CVSS 3.0HIGH 7.5
  • TI-2017-07193 In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences